A Novel Graphical Password Scheme to Avoid Shoulder-Surfing Attacks in Android Devices

Traditional text based password schemes are subjected to dictionary attacks on a very large scale. As a solution, graphical password schemes are a promising alternative to text-based recognition schemes where instead of text, images are chosen for a password. However, these schemes are again affected due to shoulder surfing and less effective due to large dictionary space. This paper focuses on providing a solution based on text-based graphical password techniques, a combination of Déjà vu and Moveable Frame scheme. Déjà vu is further replaced by text-based images than purely graphics. Our research has two main objectives: 1) To thwart shoulder surfing 2) To minimize the search time of pass images on the login screen. The project was implemented as a resulting android application using Android Studio. Results show the proposed scheme of graphical password system with multiple alphabet images is more recognizable and has less cognitive load on user as compared to image based graphical password schemes. The incorrect login rate for multiple alphabet based images with movable frame was 15% more than graphical password schemes thus a better solution to protect shoulder surfing.

The authentication textual passwords are the most widely used technique. However, this type of legacy authentication is vulnerable to various attacks, such as shoulder-surfing attacks. Hence, graphical password authentication is one of these approaches which has been suggested to overcome the issues related to textual passwords. Nevertheless, the hackers have also developed new techniques that can be finally broken the graphical password, for instance, listening to the transmitted information between the client and the server. In this paper, Passnumbers graphical authentication password is proposed. Passnumbers approach involves two new stages, which are first, using the coordinates of a graphical grid cells-based numbers for entering the password. The second stage is represented by deploying a new technique to encrypt the password based on the image pixels. The performance evaluation reveals that the proposed Passnumbers can provide high resistance against several graphical password attacks including shoulder surfing and eavesdropping attacks. Passnumbers is evaluated using several metrics including security and usability.

In this paper, we discuss how to prevent users' passwords from being stolen by adversaries. Textual-based password authentication scheme tend to be more vulnerable to attacks such as shoulder surfing. To overcome the vulnerabilities of traditional methods, visual or graphical password schemes have been developed as possible alternative solutions to text-based scheme. But simply adopting graphical password authentication also has some drawbacks; hence some hybrid schemes based on text as well as graphics were developed. We propose a virtual password concept involving a small amount of human computing to secure users' passwords in on-line environments. We also analyze how the proposed scheme defends against phishing, key logger, shoulder-surfing, man in the middle and session hijacking attacks.

Authentication is one of the most important mechanisms to ensure system accessibility by legitimate users. Various authentication tools exist based on numerous techniques. Distinguishing factors of such authentication tools are the underlying passwords that they imply. These passwords can be textual based, graphical based, hardware based or biometric based. All such password types have their pros and cons. The principle focus of this research is picture-based graphical passwords, since they are easy to remember and can overcome the limitations of using long textual passwords for stronger security. However, mostly the picture-based passwords suffer from shoulder surfing attacks and are therefore vulnerable. If this vulnerability is overcome then such graphical passwords are highly useful because of their strength and ease of use as compared to long textual passwords. The main objective of this research is to propose and develop a picture-based authentication scheme with anti shoulder surfing capability. The proposed authentication scheme consists of both password creation and usage. Both these stages are supported by specialized technical constructs that overcome the anti shoulder surfing attack even if the attacker is standing next to the legitimate user.

Since conventional password schemes are vulnerable to shoulder surfing, many shoulder surfing resistant graphical password schemes have been proposed. However, as most users are more familiar with textual passwords than pure graphical passwords, text-based graphical password schemes have been proposed. Unfortunately, none of existing text-based shoulder surfing resistant graphical password schemes is both secure and efficient enough. In this paper, we propose an improved text-based shoulder surfing resistant graphical password scheme by using colors. In the proposed scheme, the user can easily and efficiently login system. Next, we analyze the security and usability of the proposed scheme, and show the resistance of the proposed scheme to shoulder surfing and accidental login.

An alternative authentication method to traditional alphanumeric passwords is graphical password authentication, also known as graphical authentication, for which one of the most valuable cued-recall techniques is PassPoints. This technique stands out for its security and usability. However, it can be violated if the user follows a predefined pattern when selecting the five points in an image as their passwords, such as the DIAG and LINE patterns. Dictionary attacks can be built using these two patterns to compromise graphical passwords. So far, no reports have been found in the state of the art about any test capable of detecting graphical passwords with DIAG or LINE patterns in PassPoints. Studies carried out in other scenarios have shown the effectiveness of the characteristics of Delaunay triangulations in extracting information about the dependence between the points. In this work, graphical passwords formed by five randomly selected points on an image are compared with passwords whose points contain patterns of the DIAG or LINE type. The comparison is based on building for each password its Delaunay triangulation and calculating the mean value of the maximum angles of the triangles obtained; such a mean value is denoted by amadt. It is experimentally shown that in passwords containing DIAG and LINE patterns, the value of amadt is higher than the one obtained in passwords formed by random dots. From this result, it is proposed to use this amadt value as a statistic to build a test of means. This result constitutes the work’s main contribution: The proposal of a spatial randomness test to detect weak graphic passwords that contain DIAG and LINE type patterns. The importance and novelty of this result become evident when two aspects are taken into account: First, these weak passwords can be exploited by attackers to improve the effectiveness of their attacks; second, there are no prior criteria to detect this type of weak password. The practical application of said test contributes to increasing PassPoints security without substantially affecting its efficiency.

Authentication is vital for maintaining system secu- rity. Graphical password-based authentication systems provide a promising alternative to traditional authentication methods such as alphanumeric or text-based passwords. Conventional authentication systems are susceptible to brute force attacks, dictionary attacks, password guessing and user memory fatigue. Users create a personalized password by selecting a sequence of images or points in an image grid, which enhances security due to the complexity of graphical choices over traditional textual passwords. Graphical Password Based Authentication (GPA) incorporates a combination of image-based cues and persuasive elements which encourages a user to select a secure password. Our system addresses a major security concern, shoulder surfing, by creating and using hybrid images. Index Terms—Password Space, Click-Point Distribution, Guessing Attacks, Recall Study, Shoulder Surfing Attacks, PCCP (Persuasive Cued Click Points), Hotspots, Hybrid Images, Cued Recall, False Accept Points, Deep Residual Networks (DRN), Edge Detection, Hybrid Textual-Graphical Authentication, Brute- force Attacks, Pattern Matching .

In general, it is difficult to remember a strong password i.e. a long and random password. So, the common tendency of a user is to select a weak alphanumeric password that is easy to remember. But the password which is easy to remember is also easy to predict. In contrast, the password that is very difficult to predict or requires more computation to break is also difficult to remember. To overcome this limitation of creating secure and memorable passwords, researchers have developed graphical password scheme which takes images as passwords rather than alphanumeric characters. But graphical password schemes are vulnerable to shoulder-surfing attack where an attacker can capture a password by direct observation. In this paper a graphical password scheme, namely SG-PASS is proposed which can prevent the shoulder-surfing attack by a human observer and also spyware attack, using a challenge response method.

Purpose – The Android pattern lock screen (or graphical password) is a popular user authentication method that relies on the advantages provided by the visual representation of a password, which enhance its memorability. Graphical passwords are vulnerable to attacks (e.g. shoulder surfing); thus, the need for more complex passwords becomes apparent. This paper aims to focus on the features that constitute a usable and secure pattern and investigate the existence of heuristic and physical rules that possibly dictate the formation of a pattern. Design/methodology/approach – The authors conducted a survey to study the users’ understanding of the security and usability of the pattern lock screen. The authors developed an Android application that collects graphical passwords, by simulating user authentication in a mobile device. This avoids any potential bias that is introduced when the survey participants are not interacting with a mobile device while forming graphical passwords (e.g. in Web or hard-copy surveys). Findings – The findings verify and enrich previous knowledge for graphical passwords, namely, that users mostly prefer usability than security. Using the survey results, the authors demonstrate how biased input impairs security by shrinking the available password space. Research limitations/implications – The sample’s demographics may affect our findings. Therefore, future work can focus on the replication of our work in a sample with different demographics. Originality/value – The authors define metrics that measure the usability of a pattern (handedness, directionality and symmetry) and investigate their impact to its formation. The authors propose a security assessment scheme using features in a pattern (e.g. the existence of knight moves or overlapping nodes) to evaluate its security strengths.

User authentication is an essential step in information security. Textual passwords are the most traditional ways used in most user authentication systems to achieve the security of information, but textual passwords are vulnerable to many types of attacks such as: dictionary attacks, shoulder surfing, and spyware. Graphical password can overcome the shortcomings of the textual passwords, but it still vulnerable to shouldersurfing attacks, takes much space in the system and sometimes user takes a long time to enter. By using Emoji-pictures, a new technique that overcomes the drawbacks of both textual and graphical passwords was presented in this paper. The proposed technique is resistant to dictionary attacks, shoulder surfing, and spyware in addition to that it doesn't take large space in the system's database and provides a safe and enjoyable session for users during entering the password.

PassBYOP is a new graphical password scheme for public terminals that replaces the static digital images typically used in graphical password systems with personalized physical tokens, herein in the form of digital pictures displayed on a physical user-owned device such as a mobile phone. Users present these images to a system camera and then enter their password as a sequence of selections on live video of the token. Highly distinctive optical features are extracted from these selections and used as the password. We present three feasibility studies of PassBYOP examining its reliability, usability, and security against observation. The reliability study shows that image-feature based passwords are viable and suggests appropriate system thresholds—password items should contain a minimum of seven features, 40% of which must geometrically match originals stored on an authentication server in order to be judged equivalent. The usability study measures task completion times and error rates, revealing these to be 7.5 s and 9%, broadly comparable with prior graphical password systems that use static digital images. Finally, the security study highlights PassBYOP's resistance to observation attack—three attackers are unable to compromise a password using shoulder surfing, camera-based observation, or malware. These results indicate that PassBYOP shows promise for security while maintaining the usability of current graphical password schemes.

The most common issue of alphanumeric passwords is users normally create weak passwords for the reason that strong passwords are difficult to recognise and memorise. Graphical password authentication system is one of the approaches to address the issues of alphanumeric passwords memorability. Wiedenbeck et al. propose PassPoints in which a password is a sequence of any 5 to 8 user-selected click points on a system-assigned image. Nevertheless, PassPoints still faces the problem of predictable click points and shoulder surfing attack. In this paper, we propose an alternative graphical password system on smartphones called HapticPoints. By adding haptic feedback to PassPoints as additional decoy click points, the aforementioned problems can be prevented without needing users to do any additional memory task. We also conduct a user study to evaluate and compare the usability of HapticPoints and PassPoints.

Alphanumerical usernames and passwords are the most used computer authentication technique. This approach has been found to have a number of disadvantages. Users, for example, frequently choose passwords that are simple to guess. On the other side, if a password is difficult to guess, it is also difficult to remember. Graphical passwords have been proposed in the literature as a potential alternative to alphanumerical passwords, based on the fact that people remember pictures better than text. Existing graphical passwords, on the other hand, are vulnerable to a shoulder surfing assault. To address this shoulder surfing vulnerability, this study proposes an authentication system for web-applications based on visual cryptography and cued click point recall-based graphical password. The efficiency of the proposed system was validated using unit, system and usability testing measures. The results of the system and unit testing showed that the proposed system accomplished its objectives and requirements. The results of the usability test showed that the proposed system is easy to use, friendly and highly secured.

비밀번호를 입력하는 과정에서 가장 큰 보안 위협은 비밀번호를 훔쳐보는 것이다. 비밀번호 훔쳐보기는 비밀번호를 입력하는 과정을 옆에서 지켜보고 비밀번호를 획득하려고 하는 행위로서 비밀번호를 획득하는 가장 전통적인 방법이며 강력한 보안 위협이다. 본 논문에서는 인지심리학에 기초한 비밀번호 훔쳐보기로부터 안전한 기술인 역동 인증 체계(DAS)라 불리는 비밀번호 입력 기술을 제안하였다. 그리고 제안한 역동 인증 체계의 비밀번호 훔쳐보기에 대한 안전성을 직관적인 관점, 훔쳐보기 실험, 이론적인 분석으로 구분하여 검증하였다. 비밀번호 훔쳐보기로부터 안정성이 입증된 역동 인증 체계를 내장시킨 비밀번호 입력기를 설계하여 구현하였다. 구현한 비밀번호 입력기는 일반 패스워드 입력방식 보다 훔쳐보기 공격자의 비밀번호 획득 확률을 현저하게 낮출 수 있으므로 은행에서 운영하는 금융자동화기기에 적용 및 운영되기에 적합한 것으로 평가를 받아 금융기관에서 도입하여 활용되고 있다. When entering the PIN(personal identification number), the greatest security threat is shoulder surfing attack. Shoulder surfing attack is watching the PIN being entered from over the shoulder to obtain the number, and it is the most common and at the same time the most powerful security threat of stealing the PIN. In this paper, a psychology based PINpad technology referred to as DAS(Dynamic Authentication System) that safeguards from shoulder surfing attack was proposed. Also, safety of the proposed DAS from shoulder surfing attack was tested and verified through intuitive viewpoint, shoulder surfing test, and theoretical analysis. Then, a PINpad with an internal DAS that was certified for its safety from shoulder surfing attack was designed and produced. Because the designed PINpad significantly decreases the chances for shoulder surfing attackers being able to steal the PIN when compared to the ordinary PINpad, it was determined to be suitable for use at ATM(automated teller machine)s operated by banks and therefore has been introduced and is being used by many financial institutions.

The most important kind of authentication used is PIN authentication which is simple, effective and usable, but it is prone to an attack known as shoulder surfing. Shoulder surfing refers to a direct observation, such as looking over a person's shoulder, to obtain information. The previous work was done with the visibility of the PIN, but here we propose an innovative way to authenticate user by providing PIN to the system which won't be visible to an attacker but will be known to the actual user who is drawing it on a touch screen device. This will help in reducing the effect of the shoulder surfing attack. Another important thing which we want to try out is whether the error rate can be lowered down or not. The current implementation will be working in two distinguishable modes i.e. Learning Mode and Recognition Mode. In learning mode, user will be able to make the system to learn the templates of any character or number by writing on a touch screen. In recognition mode, the system will automatically identify the character or number drawn on the touch screen and will display the result whether inputted character or number is matched or not.